Maltego and Recon-ng Frameworks

Maltego is a graphical link analysis tool developed by Paterva. It is designed for open-source intelligence gathering and forensics. Maltego works by using "transforms"—small pieces of code that query various data sources (e.g., DNS records, WHOIS databases, social media APIs) and return entities (e.g., domains, IP addresses, email addresses, people). These entities are displayed on a graph, with edges representing relationships. The tool is available in three editions: Maltego XL (unlimited transforms, for enterprise), Maltego Classic (limited transforms, for professionals), and Maltego CE (Community Edition, free but with reduced transform credits). For PT0-002, you need to know Maltego CE and its capabilities.

When you drag an entity (e.g., a domain) onto the graph, you can right-click and select a transform. Maltego sends the entity value to a remote transform server (or a local transform if configured). The server queries the relevant data source and returns new entities. For example, the "To IP Address [DNS]" transform takes a domain and returns its resolved IP addresses. Each returned entity is added to the graph, and a directed edge is drawn from the original domain to the IP. You can then run transforms on the new entities, expanding the graph recursively. The graph is stored in a .mtgl file, which can be exported as an image or PDF.

Recon-ng is a full-featured web reconnaissance framework written in Python by Tim Tomes (lanmaster53). It provides a command-line interface similar to Metasploit, with modules for reconnaissance, discovery, and exploitation. Recon-ng is designed to automate the gathering of OSINT data through modular, repeatable workflows. It is free and open-source.

Recon-ng uses a modular architecture. Each module is a Python script that performs a specific task, such as querying an API, scraping a website, or parsing a file. Modules are organized into categories: discovery, exploitation, import, recon, and reporting. The framework manages a workspace-specific SQLite database that stores all collected data (contacts, hosts, domains, etc.). Modules can read from and write to this database, allowing data to be shared between modules. For example, you can run a module that finds subdomains, which writes results to the hosts table, then run another module that resolves those hosts to IP addresses, and a third that geolocates the IPs.

Both tools can be used in the same penetration test. Typically, a tester might start with Recon-ng to automate bulk data collection (e.g., enumerate all subdomains, find email addresses, check for breaches). Then, the collected data can be imported into Maltego for visual analysis. Recon-ng can export data as CSV, which Maltego can import via the "Import" feature (File > Import > Import CSV). Alternatively, Maltego can query some of the same data sources directly, but Recon-ng is more efficient for large-scale automated collection.

Maltego Transforms to Know: - To IP Address [DNS] – Resolves a domain to IPv4 and IPv6 addresses. - To DNS Name [NSLookup] – Performs a DNS lookup for common record types (A, AAAA, MX, NS, etc.). - To Website [Bing] – Searches Bing for pages related to the entity. - To Person [Social Networks] – Attempts to find social media profiles for a person. - To Email Address [TheHarvester] – Uses the Harvester to find email addresses associated with a domain. - To Company [Whois] – Performs a WHOIS lookup on a domain to find registrant info. - To Phone Number [WhitePages] – Looks up a phone number in WhitePages (US only).

Recon-ng Modules to Know: - recon/domains-hosts/google_site_web – Uses Google dorking to find subdomains. - recon/domains-hosts/brute_hosts – Brute-forces subdomains using a wordlist. - recon/hosts-hosts/resolve – Resolves hostnames to IP addresses. - recon/hosts-hosts/reverse_resolve – Performs reverse DNS lookup. - recon/contacts-contacts/mailtester – Verifies email addresses using SMTP. - recon/contacts-contacts/linkedin_contacts – Scrapes LinkedIn for employee names and titles. - recon/companies-contacts/bing_linkedin_cache – Finds LinkedIn profiles via Bing cache. - recon/domains-vulnerabilities/vulnerability_scan – Checks for known vulnerabilities using the Exploit Database. - reporting/list – Exports data in various formats.

Both tools support automation. In Maltego, you can use "Machines" to run a sequence of transforms automatically. In Recon-ng, you can write resource scripts. For example, a resource script to enumerate a domain:

workspaces create example_audit
load recon/domains-hosts/google_site_web
set SOURCE example.com
run
load recon/hosts-hosts/resolve
set SOURCE default
run
load reporting/list
set FILENAME /tmp/example_report.html
set FORMAT html
run
exit

Run it with recon-ng -r script.rc.

Maltego CLI (using maltego-trx, a Python library): Not commonly used on PT0-002. The GUI is the primary interface.

Recon-ng command examples:

recon-ng
[recon-ng][default] > workspaces create acmecorp
[recon-ng][acmecorp] > load recon/domains-hosts/google_site_web
[recon-ng][acmecorp][google_site_web] > set SOURCE acme.com
[recon-ng][acmecorp][google_site_web] > run
[recon-ng][acmecorp][google_site_web] > back
[recon-ng][acmecorp] > load recon/hosts-hosts/resolve
[recon-ng][acmecorp][resolve] > set SOURCE default
[recon-ng][acmecorp][resolve] > run
[recon-ng][acmecorp][resolve] > back
[recon-ng][acmecorp] > db query "SELECT * FROM hosts"
[recon-ng][acmecorp] > load reporting/list
[recon-ng][acmecorp][list] > set FILENAME /tmp/acme_hosts.csv
[recon-ng][acmecorp][list] > set FORMAT csv
[recon-ng][acmecorp][list] > run

Scenario 1: Penetration Testing a Medium-Sized Company

A penetration tester is hired to assess the security of a company called "Acme Corp." The tester starts with only the domain acme.com. Using Recon-ng, the tester runs the google_site_web module to find subdomains like mail.acme.com, dev.acme.com, and vpn.acme.com. Then the brute_hosts module with a wordlist of common subdomains discovers additional hosts like jenkins.acme.com. The resolve module converts these to IP addresses. The tester then uses the linkedin_contacts module (with a valid LinkedIn API key) to find employee names and email addresses. All data is stored in the Recon-ng database. The tester exports the hosts to CSV and imports them into Maltego. In Maltego, the tester runs transforms on the IP addresses to find adjacent domains (e.g., acme-cloud.com) and on email addresses to find social media profiles. The visual graph reveals that the developer, John Doe, uses his work email for a personal GitHub account, which may leak credentials. The tester documents this as a finding. This scenario demonstrates the complementary use of both tools: Recon-ng for bulk collection, Maltego for relationship discovery.

Scenario 2: Red Team Engagement with Time Constraints

A red team has 48 hours to perform reconnaissance on a large organization with multiple subsidiaries. They use Recon-ng resource scripts to automate the entire process. They create a script that iterates through a list of 20 domains, runs subdomain enumeration, resolves IPs, performs reverse DNS, and checks for open ports using the Shodan module. The script runs overnight, collecting data into separate workspaces. The next day, the team imports the most promising targets into Maltego for visual analysis. They use Maltego's "Machines" feature to run a footprinting machine on each target domain, which automatically runs a series of transforms to map out the attack surface. The visual output helps the team identify critical assets like VPN endpoints and admin panels. Without Recon-ng's automation, they would not have covered all 20 domains in time. The exam might ask: "Which tool would you use to automate reconnaissance across multiple domains?" The answer is Recon-ng with resource scripts.

Scenario 3: OSINT Investigation for Social Engineering

A social engineering test requires gathering personal information on key employees. The tester uses Maltego starting with the company name. The "To Person [Social Networks]" transform finds LinkedIn profiles. The tester then runs "To Email Address [TheHarvester]" to find associated email addresses. In Recon-ng, the tester uses the mailtester module to verify which email addresses are valid. The tester also uses the whois_pocs module to find administrative contacts from WHOIS records. The combined data gives a detailed profile of each employee, including their role, email, phone number, and social media presence. This information is used to craft convincing phishing emails. The exam may test your knowledge of which transforms/modules are appropriate for gathering specific types of data (e.g., mailtester for email verification, linkedin_contacts for employee names).